# Gsub replace based on pattern
**URL:** https://discuss.elastic.co/t/gsub-replace-based-on-pattern/256352
**Category:** Logstash
**Created:** [November 23, 2020, 12:20pm UTC](https://discuss.elastic.co/t/gsub-replace-based-on-pattern/256352 "2020-11-23T12:20:23Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)
#### Post date: [November 23, 2020, 12:20pm UTC](https://discuss.elastic.co/t/gsub-replace-based-on-pattern/256352/1 "2020-11-23T12:20:23Z")
i have log in below format , i need to replace ":" from 17:18:12 to 17-18-12 ...as this colon is also present at other places in line , how to match this
mutate { gsub =\> ["message", "\d\d:\d\d:\d\d", "\d\d-\d\d-\d\d"] does not work
**Log**
**"This is a test:message however it was originated 17:18:12 but help:question abc "**
---
### Author:  [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)
#### Post date: [November 23, 2020, 1:03pm UTC](https://discuss.elastic.co/t/gsub-replace-based-on-pattern/256352/2 "2020-11-23T13:03:49Z")
Hello Muhammad,
Welcome to this forum! 🥳
I have not tried it but something like this should work:
```auto
mutate { gsub => ["message", "(\d\d):(\d\d):(\d\d)", "$1-$2-$3"] }
```
The brackets in the first regex mark groups which can be referenced later by using $x.
Best regards
Wolfram
---
### Author:  [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)
#### Post date: [November 23, 2020, 1:25pm UTC](https://discuss.elastic.co/t/gsub-replace-based-on-pattern/256352/3 "2020-11-23T13:25:51Z")
not working , it gives output
"message" =\> "$1-$2-$3\r",
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 23, 2020, 2:43pm UTC](https://discuss.elastic.co/t/gsub-replace-based-on-pattern/256352/4 "2020-11-23T14:43:18Z")
ruby use \1 etc. to reference capture groups. It does not use the perl syntax of $1 etc. Try
```
mutate { gsub => ["message", "(\d\d):(\d\d):(\d\d)", "\1-\2-\3"] }
```
---
### Author:  [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)
#### Post date: [November 23, 2020, 3:01pm UTC](https://discuss.elastic.co/t/gsub-replace-based-on-pattern/256352/5 "2020-11-23T15:01:28Z")
still not working i am getting below output
"message" =\> "--\r"
if my input message has 17:18:12 , i need to replace it and display as 17-18-12
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 23, 2020, 3:29pm UTC](https://discuss.elastic.co/t/gsub-replace-based-on-pattern/256352/6 "2020-11-23T15:29:28Z")
That means the capture groups were empty, which means the original message just consisted of "\r". Your message does not contain what you think it contains.
---
### Author:  [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)
#### Post date: [November 24, 2020, 7:22am UTC](https://discuss.elastic.co/t/gsub-replace-based-on-pattern/256352/7 "2020-11-24T07:22:59Z")
@Muhammad_Faisal I am sorry, I was not aware of the difference between Ruby and other Regex implementations.
---
### Author:  [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)
#### Post date: [November 24, 2020, 7:53am UTC](https://discuss.elastic.co/t/gsub-replace-based-on-pattern/256352/8 "2020-11-24T07:53:59Z")
> [@Muhammad\_Faisal](#):
>
> This is a test:message however it was originated 17:18:12 but help:question abc
thanks Badger its working.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 22, 2020, 7:54am UTC](https://discuss.elastic.co/t/gsub-replace-based-on-pattern/256352/9 "2020-12-22T07:54:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.